CVE-2022-1656: JupiterX Theme <= 2.0.6 and JupiterX Core <= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings Modification
Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterxapiajax actions registered by the JupiterX Core Plugin (<=2.0.6). This includes the ability to deactivate arbitrary plugins as well as update the theme’s API key.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1656?
CVE-2022-1656 is classified as a critical vulnerability due to its ability to allow unauthorized access and privilege escalation.
How do I fix CVE-2022-1656?
To fix CVE-2022-1656, update the JupiterX Theme and JupiterX Core Plugin to version 2.0.7 or later.
Who is affected by CVE-2022-1656?
Any site using vulnerable versions of the JupiterX Theme or JupiterX Core Plugin, specifically versions 2.0.6 or lower, is at risk.
What types of attacks can CVE-2022-1656 enable?
CVE-2022-1656 can enable attacks that allow unauthorized users to perform privileged actions on the affected WordPress sites.
Is authentication necessary to exploit CVE-2022-1656?
Yes, a logged-in user, even with a low-level subscriber role, can exploit CVE-2022-1656.